National Center for Forensic Science
A program of the National Institute of Justice hosted by the
University of Central Florida
 Forensic Resource Network  

 
   


Training

All NCFS Training:

Training Calendar
Upcoming Training Opportunities of Interest to the Forensic Science,
Law Enforcement, and Public Safety Communities

Dates:
 September 14, 2009
Course Title:
 2009 TWGFEX Fire and Explosions Symposium
Description:

This is a one-day symposium for fire and explosion laboratory analysts and scene investigators will feature presented papers of interest to each group. The symposium will be followed by a number of workshops. This symposium is sponsored by the National Center for Forensic Science (NCFS), hosted by University of Central Florida (UCF) and funded by the National Institute of Justice (NIJ). The symposium has been organized by members of the Technical Working Group for Fire and Explosions (TWGFEX). The symposium will feature invited speakers who will present papers on issues of interest to laboratory and scene personnel. Topics of interest to investigators will include: Introduction to Peroxide Explosives Manufacturing; Computer Fire Modeling; Chemical Incendiaries and Hypergolic Mixtures; Understanding Ignitable Liquid Classifications and Why They are Used; Explosion Investigation and Reconstruction Using Multi Disciplinary Methods; Location, Recovery, and Analysis of DNA on Post Bomb Fragments; Identification of Smokeless Powders by a Variety of Analytical Methods; Wound Patterns from Blast Effects; and How Pyrotechnics Are Measured. The symposium will be followed by workshops on Explosives Debris Analysis, Fire Debris Analysis, Fire Dynamics, Organic Chemistry for Fire Debris Analysts, and Post-Blast Investigation – the length of time for each workshop will vary.
Prerequisites:

The one-day symposium is open to the general public (attendance at the symposium is a co-requisite for all students enrolled in the five courses whose workshops following the symposium). Space is limited, and applicants will be accepted on a “first come, first serve” basis.

Location and
Duration:

Florida Hotel and Conference Center
1500 Sand Lake Road
Orlando, Florida 32809

Telephone (407) 816-5182, fax (407) 855-9863 Website: www.thefloridahotelorlando.com
Instructors:

Invited speakers represent ATF, FBI, U. S. Postal Service, various state/local agencies and laboratories, and instructors from colleges/universities.
Costs:

Registration for the symposium is free courtesy of the National Institute of Justice.

Note – students registered to attend the workshops at the Florida Hotel and Conference Center the week of September 14, 2009 will automatically be registered to attend the symposium (a prerequisite for successfully completing any of the five workshops being offered).
Application:

Please Note: All of the web-based classes associated with the symposium have been filled. Symposium-only registration is still open; however, due to filling out of the student base for the classes, transportation to Orlando for those who register for only the symposium is the requirement of the attendee.

Print application here and fax it to (407) 823-3162. For general inquiries, contact NCFS at (407) 823-6469.



Dates:
 September 14-18, 2009
Course Title:
 Comprehensive Fire Debris Analysis
Description:

This course is Web-based, followed by the face-to-face workshop held at the Florida Hotel and Conference Center in Orlando, Florida.  The online portion of the course will begin in July/August 2009; successful completion of the course requires participation in online activities, the completion of all online assessments, attending the 2009 TWGFEX Fire and Explosions Symposium (September 14, 2009), and attendance at the face-to-face component of the course scheduled for September 15-18, 2009.
Prerequisites:

Students must complete all online components of the course, as well as attend the 2009 TWGFEX Fire and Explosions Symposium (September 14, 2009) before attending the face-to-face component of the course scheduled for September 15-18, 2009.
Location and
Duration:

Florida Hotel and Conference Center
1500 Sand Lake Road
Orlando, Florida 32809

Telephone (407) 816-5182, fax (407) 855-9863 Website: www.thefloridahotelorlando.com
Instructors:

Invited speakers represent ATF, FBI, U. S. Postal Service, various state/local agencies and laboratories, and instructors from colleges/universities.
Costs:

Registration for the symposium is free courtesy of the National Institute of Justice.

Note – students registered to attend the workshops at the Florida Hotel and Conference Center the week of March 23, 2009 will automatically be registered to attend the symposium.
(a prerequisite for successfully completing any of the five workshops being offered)
Application:
 No longer accepting applications for this class. For general inquiries, contact NCFS at (407) 823-6469.



Dates:
 September 14-15, 2009
Course Title:
 Organic Chemistry for Fire Debris Analysts
Description:

This course covers structure, nomenclature, and reactions of organic molecules with particular emphasis on fire science; fire dynamics; combustion theory; thermal degradation of organic molecules; polymers and their impact on fire scenes and analysis; petroleum refining and petrochemical operations; mass spectrometry, other analytical methods, and emerging methods for organic analysis; and interpretation of results.

This course is Web-based, followed by the face-to-face workshop held at the Florida Hotel and Conference Center in Orlando, Florida.  The online portion of the course will begin in July/August 2009; successful completion of the course requires participation in online activities, the completion of all online assessments, attending the 2009 TWGFEX Fire and Explosions Symposium (September 14, 2009), and attendance at the face-to-face component of the course scheduled for September 15, 2009.
Prerequisites:

In general, the prerequisites are a chemistry degree or general, analytical, and inorganic and organic chemistry college coursework; one year conducting fire-debris analysis or other forensic chemistry experience.

Students must complete all online components of the course, as well as attend the 2009 TWGFEX Fire and Explosions Symposium (September 14, 2009) before attending the face-to-face component of the course scheduled for September 15, 2009.
Location and
Duration:

Florida Hotel and Conference Center
1500 Sand Lake Road
Orlando, Florida 32809

Telephone (407) 816-5182, fax (407) 855-9863 Website: www.thefloridahotelorlando.com
Costs:
 The 2009 course is being presented in conjunction with the 2009 Annual Symposium of the National Center for Forensic Science and in that regard is cost-free based on a grant from the National Institute of Justice.
Application:
 No longer accepting applications for this class. For questions, contact Steve Allen at 804-224-2748.



Dates:
 September 14-18, 2009
Course Title:
 Low Explosive Identification and Analysis
Description:

This course covers analysis of both intact low explosives and analysis of debris for the presence of post-blast low explosives materials; the chemistry of explosives; the use of the different types of instrumentation relevant to low explosives analysis; extraction methods for low explosives debris; report writing and testimony of explosives analysts; and other topics related to explosives analysis.

This course is Web-based, followed by the face-to-face workshop held at the Florida Hotel and Conference Center in Orlando, Florida. The online portion of the course will begin in July/August 2009; successful completion of the course requires participation in online activities, the completion of all online assessments, attending the 2009 TWGFEX Fire and Explosions Symposium (September 14, 2009), and attendance at the face-to-face component of the course scheduled for September 15-18, 2009.
Prerequisites:

In general, the prerequisites are a chemistry degree or general, analytical, and inorganic and organic chemistry college coursework; one year conducting explosives debris analysis or other forensic laboratory experience using mass spectral, infrared, x-ray diffraction, and other instrumental methods of analysis.

Students must complete all online components of the course, as well as attend the 2009 TWGFEX Fire and Explosions Symposium (September 14, 2009) before attending the face-to-face component of the course scheduled for September 15-18, 2009..
Location and
Duration:

This course is taught at the National Center for Forensic Science, University of Central Florida Research Park, 12354 Research Parkway, Orlando, Florida 32826; 8 am to 5 pm. The mailing address is Post Office Box 162367, Orlando, Florida 32816-2367.
Costs:
 Florida Hotel and Conference Center
1500 Sand Lake Road
Orlando, Florida 32809

Telephone (407) 816-5182, fax (407) 855-9863 Website: www.thefloridahotelorlando.com
Application:
 No longer accepting applications for this class. For questions, contact Steve Allen at 804-224-2748.



Dates:
 September 14-15, 2009
Course Title:
 Post Bomb Blast Investigation
Description:

This web based course will provide training in the processing of explosion scenes, taking the student through the logical progression from developing a plan of standard operating procedures utilizing NIMS, identifying and collecting evidence at the crime scene, documentation methods, proper submission of evidence to the Laboratory, and presentation of evidence through a legal and/or administrative briefing exercise.

The course will provide the student specialized knowledge to analyze explosions involving condensed-phase explosives. This includes a foundation in the theory of explosive effects, explosives terminology, explosive products, improvised explosive devices, post-blast identification of bomb components, bomb reconstruction and intercomparisons, forensic capabilities in bomb cases, and laws relating to explosives/bombings identifying jurisdictional guidelines.

The following modules comprise the course:

  • Describe Explosions
  • Effectively manage and process a pre-blast scene
  • Describe Explosives
  • Recognize common and frequently used commercial explosives
  • Identify pre & post blast IED components
  • Based on existing guidelines, tailor SOP for processing a pre- and post-blast scene investigation for student’s jurisdiction
  • Effectively manage and process a post blast scene within context of NIMS
  • Blast scene equipment
  • Know the capabilities of forensic Laboratories for analysis of bomb evidence
  • Know state and federal laws relating to explosions, explosives, destructive devices, jurisdictional, and investigative response.

This course is Web-based, followed by the face-to-face workshop held at the Florida Hotel and Conference Center in Orlando, Florida.  The online portion of the course will begin in July/August 2009; successful completion of the course requires participation in online activities, the completion of all online assessments, attending the 2009 TWGFEX Fire and Explosions Symposium (September 14, 2009), and attendance at the face-to-face component of the course scheduled for September 15, 2009.
Prerequisites:

Be familiar with the Guide for Explosion and Bombing Scene Investigation, U. S. Department of Justice, 2000. http://www.ojp.usdoj.gov/nij or http://ncfs.ucf.edu/twgfex/documents.html

Completion of National Incident Management System Incident Command System (NIMS ICS) course series 100, 200, 400 and 700. (If the student has not completed those courses, they can be accessed at the following address www.fema.gov/emergency/nims). Once completed, the certificate should be uploaded as verification that the course was completed.

Students must complete all online components of the course, as well as attend the 2009 TWGFEX Fire and Explosions Symposium (September 14, 2009) before attending the face-to-face component of the course scheduled for September 15, 2009.
Location and
Duration:

Florida Hotel and Conference Center
1500 Sand Lake Road
Orlando, Florida 32809

Telephone (407) 816-5182, fax (407) 855-9863 Website: www.thefloridahotelorlando.com
Costs:
 There is no cost for the selected students. This course is being presented in conjunction with the 2009 Annual Symposium of the National Center for Forensic Science and in that regard is cost free based on a grant from the National Institute of Justice.
Application:
 No longer accepting applications for this class. For questions, contact Tom Minnich at tminnich@mail.ucf.edu



Dates:
 September 14-15, 2009
Course Title:
 Fire Dynamics
Description:

This web based is being developed and will help investigators solve some of the challenges facing them in preparing a technically defensible fire investigation.

Understanding fire dynamics is critical to a fire investigator when determining the origin and cause of fires. The overall objective for the course is to give the student the tools and ability to utilize the phenomena of fire dynamics in their day-to-day investigation of fires and explosions. This course will permit the student to gain this knowledge through the web and permit that student to complete it at his or her own pace. By completion of the course the student will have the knowledge to:

  • Define fire
  • Understand basic fire physics and chemistry
  • Understand heat transfer and fluid dynamics
  • Define and understand smoldering, pre-mixed flames, diffusion and fires caused by spontaneous combustion
  • Understand Ignition as it relates to solids, liquids and gases
  • Understand how fire develops both in confined and unconfined areas
  • Understand flashover and back draft and how it impacts on scene investigation
  • Develop skills to utilize fire modeling programs and the value of using those programs in investigations and limitations of using fire modeling in court
  • Understand and utilize how fire dynamics are used in overall fire/explosive investigations

This course is Web-based, followed by the face-to-face workshop held at the Florida Hotel and Conference Center in Orlando, Florida.  The online portion of the course will begin in July/August 2009; successful completion of the course requires participation in online activities, the completion of all online assessments, attending the 2009 TWGFEX Fire and Explosions Symposium (September 14, 2009), and attendance at the face-to-face component of the course scheduled for September 15, 2009.
Prerequisites:

In general, students must be active fire investigators. They must commit to completing the entire web based course and provide feed back at the March 23, 2009 symposium.

Students must complete all online components of the course, as well as attend the 2009 TWGFEX Fire and Explosions Symposium (September 14, 2009) before attending the face-to-face component of the course scheduled for September 15, 2009.
Location and
Duration:

Florida Hotel and Conference Center
1500 Sand Lake Road
Orlando, Florida 32809

Telephone (407) 816-5182, fax (407) 855-9863 Website: www.thefloridahotelorlando.com
Costs:
 There is no cost for the selected students. This course is being presented in conjunction with the 2009 Annual Symposium of the National Center for Forensic Science and in that regard is cost free based on a grant from the National Institute of Justice.
Application:
 No longer accepting applications for this class. For questions, contact Tom Minnich at tminnich@mail.ucf.edu



Dates:
 June 8-11, 2009
Course Title:
 Cell Phone Forensics course- Mobile Forensics 101 Workshop
Description:

The Orlando Police Department is hosting a hand held forensics course put on by Mobile Forensics Inc.

An introduction to the legal issues, service providers and current methodologies. Hands on instruction on data extraction from GSM, iDEN and CDMA handsets, using a multitude of software to include Paraben’s Device Seizure, Susteen’s Secure View, MobilEdit, Oxygen, Bitpim and many more! Students will learn the basics of the cellular network and will have a foundation in the history of cellular technology.

4 Day course which will cover the following material:

  • Legal Considerations/ History of Mobiles
  • Introduction to the cellular network
  • Handsets and SIM cards
  • Device Seizure/MobilEdit/Secure View/Oxygen/Bitpim
  • Unlocking CDMA and GSM handsets
  • Faraday Technology
  • Manual Examinations
  • Trouble Shooting
  • Preparing data for reporting
  • Call Detail Records
  • Trial Preparation
  • Practical and Written examination
Prerequisites:

none
Location and
Duration:

4 day class will be held at the National Center for Forensic Science, in Room 315.
Costs:

$2150 includes:

  • Device Seizure License
  • Mobile Edit License
  • Susteen Universal Cable Kit
  • ACR SIM card reader
  • Laptop bag/MFI Thumbdrive/Course Materials
  • MFI Shielding cloth

$1500 includes:

  • Mobile Edit License
  • Susteen Universal Cable Kit
  • ACR SIM card reader
  • Laptop bag/MFI Thumbdrive/Course Materials
  • MFI Shielding cloth

$1000 includes:

  • Instruction ONLY
  • Laptop bag/MFI Thumbdrive/Course Materials

**All students no matter the pricing schedule get to use ALL software/hardware in class
Application:
 Please go to mobileforensics.com for application.



Dates:
 June 9-11, 2009
Course Title:
 Applied Decryption
Description:
This advanced AccessData training course provides the knowledge and skills necessary to use the Unicode compliant Password Recovery Toolkit (PRTK) and Distributed Network Attack (DNA) tools, as well as TACC and PORT devices to recover passwords from industry standard applications and systems. Attendees should already be conducting computer based investigations and be familiar with the AccessData suite of tools. FTK and Registry Viewer will also be utilized.

While learning how to create effective attack profiles that include biographical profile dictionaries, user-defined dictionaries and unicode compliant character searches, students will determine how several commonly applied encryption schemes work. Students will crack applications such as:

o ARJ
o PGP
o RAR
o Adobe
o WinZip
o Quicken
o CuteFTP
o BestCrypt
o Quickbooks
o VersaCheck
o Microsoft EFS
o Microsoft Money
o Stegonography Files
o SAM Logon Passwords
o Microsoft Office Applications
o and many others ...

Students will plan, install and use a Distributed Network Attack environment and use AccessData web crawling and passphrase generation technology to create Unicode and code-page dictionaries to enhance attack profiles.

Students will also utilize a “TACC” device and a “Portable Office Rainbow Table” (PORT) with a standalone machine to increase the ability to crack more difficult passwords in a reasonable amount of time. As a single TACC can emulate a small DNA network for a fraction of the cost, students will have more options for decryption technology from AccessData.

Cryptography systems will be explained and exploited using Rainbow Table technology. Public Key Infrastructure will be explained, and students will learn practical application of arrays, XOR, ciphers and more.

This advanced level, hands-on intensive course is intended for Forensic Investigators, Law Enforcement Personnel and security and network administrators who desire a greater understanding of password recovery and decryption technology in a stand-alone and / or distributed network environment.

The Applied Decryption course includes an optional Practical Skills Assessment (PSA) that requires participants to apply concepts presented during the course to complete a practical exercise. Participants who successfully complete this exercise receive a certificate of PSA completion.

Click on the link below to view the course syllabus:
http://www.accessdata.com/media/en_us/print/training/syllabus.apdec.en_us.pdf		  
 
Prerequisites:

none
Location and
Duration:

NCFS / Room 315

Costs:
 3-day training registration $2,495.00
Application:
 Email AccessData Representative



Dates:
 July 7-9, 2009 (more information will be posted as it becomes available)
Course Title:
 MPE Analysis (Mobile Phone Examiner)
Description:
 TBA
Prerequisites:

TBA
Location and
Duration:

NCFS / Room 315

Costs:
 TBA
Application:
 TBA



Dates:
 August 4-6, 2009 (more information will be posted as it becomes available)
Course Title:
 Mac Forensics
Description:
 TBA
Prerequisites:

TBA
Location and
Duration:

NCFS / Room 315

Costs:
 TBA
Application:
 TBA



Dates:
 September 22-24, 2009
Course Title:
 AccessData Bootcamp
Description:

This course provides students with the knowledge and skills necessary to install, configure, and effectively use the combined abilities of AccessData's Forensic Toolkit (FTK) and Password Recovery Toolkit (PRTK) to locate and examine email messages, deleted files, free space and file slack.

Additionally, students will learn how to search for and export graphic files, as well as export and gain access to encrypted files from multiple industry standard applications. Documenting digital media information and working with multiple forensic image formats are also explored.

This intermediate level, hands-on intensive course is intended for Forensic Investigators, Law Enforcement Personnel and Security and Network Administrators that are responsible for creating cases that examine, analyze, and classify digital evidence.

The AccessData BootCamp course includes an optional Practical Skills Assessment (PSA) that requires participants to apply concepts presented during the course to complete a practical exercise. Participants who successfully complete this exercise receive a certificate of PSA completion.

Prerequisites:

none
Location and
Duration:

NCFS / Room 315

Costs:
 3-day training registration $2,495.00
Application:
 Email AccessData Representative



Dates:
 October 6-8, 2009
Course Title:
 Windows Forensics - Registry
Description:

In the continually evolving Windows Forensics series, the Windows registry continues to be a major source of Windows related artifact and information storage. Having the proper knowledge of registry based artifacts can make or break an investigation. In this course, attendees will utilize AccessData technology while being exposed to:

• Registry hive, cell and “hbin” block construction
• Live registry file capture from a Windows environment
• Carving registry key information from dumped memory files
• Registry testing, analysis and reporting technology
• Registry back-ups (system Volume Information and Restore Points)
• Tracking Trojan Horse programs through a suspect registry
• Tracking file associations and class ID information
• Analyzing mounted device association (USB and other devices)
• Discovering machine compromise through registry infiltration
Prerequisites:

none
Location and
Duration:

NCFS / Room 315

Costs:
 3-day training registration $2,495.00
Application:
 Email AccessData Representative



Dates:
 November 3- 5, 2009
Course Title:
 Windows Forensics - Vista
Description:

This advanced AccessData workshop provides the knowledge and skills necessary to analyze Microsoft® Windows Vista™ operating system artifacts and file system mechanics using Forensic Toolkit (FTK), FTK Imager, Password Recovery Toolkit (PRTK), and Registry Viewer.

During this three-day workshop, participants will review the following:

o GUID Partition Tables. (GPT): Students will use FTK Imager to navigate the new GPT formatted drive partitioning scheme.
o File Structure Changes: Students will learn the mechanics of reparse and mount points in the Windows Vista file structure.
o BitLocker-Full Volume Encryption (FVE): Students will use FTK Imager and Windows Vista technology to decrypt and acquire a sector-by-sector image of an FVE drive.

Windows Vista Artifacts such as:

o Vista EFS -- Updated EFS Algorithms
o Recycle Bin -- Updated File Recovery Mechanics
o Thumbcache -- Enhanced Thumbs.db Functionality
o Activity History -- Local Machine and Browser Indices
o Link and Spool Files -- Structure and Content Changes
o Windows Event Logs -- Enhanced XML Output and Viewing
o Volume Shadow Copy -- Previous File Version Recovery (SVI)
o Windows Vista Registry
o NTUser.DAT Changes -- MRU and UserAssist Changes
o SAM Hive User Changes -- Domain and User Value Additions
o System USBStor Information -- Device Identification and Protection
o Auto Complete & Search Terms -- Updated for Vista & Internet Explorer 7

The workshop includes multiple hands-on labs that allow students to apply what they have learned in the workshop.

Prerequisites:
To obtain the maximum benefit from this workshop, attendees should be familiar with:
o Windows XP forensic analysis
o Windows NT file system (NTFS) mechanics
o FTK, FTK Imager and Registry Viewer

Course Materials and Software:
Attendees will receive reference documentation and workshop files.
Prerequisites:

Prerequisites:
To obtain the maximum benefit from this workshop, attendees should be familiar with:
o Windows XP forensic analysis
o Windows NT file system (NTFS) mechanics
o FTK, FTK Imager and Registry Viewer

Location and
Duration:

NCFS / Room 315

Costs:
 3-day training registration $2,495.00
Application:
 Email AccessData Representative



Dates:
 December 1-3, 2009
Course Title:
 Internet Forensics
Description:
This course provides students with the knowledge and skills necessary to conduct an effective Internet application based investigation. Students should already be conducting computer based investigations and be familiar with the AccessData suite of tools. Internet based investigations experience would provide additional background knowledge but is not necessary. This is not an undercover investigations course - it is data recovery focused.

Students begin immediately working a missing person case initiated from an instant message found on the computer screen of the missing person. The case takes the student to several different machines with multiple internet chat, browsing and email platforms. In addition to using Password Recovery Toolkit (PRTK) to break sign-on passwords for the following Internet applications and Messengers:

o MSN Instant Messenger (including MSN Live)
o YAHOO Instant Messenger
o America Online and AOL Instant Messenger
o Internet Explorer and Firefox Auto-Complete
o Myspace
o Skype
o Internet Explorer 7 Intelliforms artifacts

Students will also utilize Forensic Toolkit (FTK) to locate and decrypt YAHOO Instant Messenger .DAT files, parse Internet Explorer .DAT files (History and Temporary Files) for hit rates, use counts and more - including Firefox history files, the download manager, user favorites, etc. Students will also parse America Online client files for user history, search terms, address books, buddy lists, email and more. Students will use the Registry Viewer to analyze Instant Messenger data such as:

o Shared file permission status and file transfer information
o Block or allow information for user contacts (buddy lists)
o Last user access information and Recent contacts via the messenger

This advanced level, hands-on intensive course is intended for Forensic Investigators, Law Enforcement Personnel and security and network administrators who desire a greater understanding of Internet artifact data recovery.

Courses outside North America include an overview of Peer to Peer file sharing programs such as Limewire and the network architecture on which they operate. America Online course content has been removed providing the ability for delegates to explore such forensic issues as:

o Examining P2P actvity log files
o Decrypting Kazaa registry search terms
o Determining download file sources
o Determining file and folder share status
o Decoding URL values for download file comparison by hash value

The Internet Forensics course includes an optional Practical Skills Assessment (PSA) that requires participants to apply concepts presented during the course to complete a practical exercise. Participants who successfully complete this exercise receive a certificate of PSA completion.		  
 
Prerequisites:

none
Location and
Duration:

NCFS / Room 315

Costs:
 3-day training registration $2,495.00
Application:
 Email AccessData Representative


NIJ The NCFS is a program of the Office of Justice Programs, National Institute of Justice hosted by the University of Central Florida.
University of Central Florida The University of Central Florida is a major metropolitan research university whose mission is to deliver a comprehensive program of teaching, research, and service. UCF is one of 10 universities in the State of Florida University system with an approximate enrollment of 45,000.

This page is maintained by
David Galat dgalat@mail.ucf.edu
Last update: June 11, 2009

Free Hit Counters
stats counter